Which versions of Acer Connect M6E are affected by CVE-2026-50211?

Acer Connect M6E 5G Portable WiFi Routers with firmware M6E_AI_1.00.000019 and earlier contain a high-severity vulnerability (CVSS 8.8) enabling persistent unauthorized modification of device…

How to fix or mitigate CVE-2026-50211?

24 hours: Inventory all Acer Connect M6E 5G routers (firmware M6E_AI_1.00.000019 or earlier) in use; disable factory diagnostics if accessible through device administration settings. 7 days: Segment affected routers from core network infrastructure and enforce restricted administrative access; configure alerting for unauthorized configuration changes. 30 days: Subscribe to Acer security advisories for patch notifications; evaluate replacement with alternative router vendors if patches remain unavailable.

Acer Connect M6E CVE-2026-50211

Q: What is the CVSS score of CVE-2026-50211?

CVE-2026-50211 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34223 HIGH

Use of Externally-Controlled Format String (CWE-134)

2026-06-04 Acer

GHSA-pcc5-98xf-vpff

Information Disclosure Connect M6E 5G Portable Wifi Router Acer

8.8

CVSS 4.0 · Vendor: Acer

Severity by source

Vendor (Acer) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Acer) · only source for this CVE.

CVSS VectorVendor: Acer

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 11:06 vuln.today

CVSS changed

Jun 04, 2026 - 09:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 07:28 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers.

AnalysisAI

Exposed factory diagnostics in Acer Connect M6E 5G Portable WiFi Router (firmware M6E_AI_1.00.000019 and earlier) allow malicious applications to obtain write access to internal NVRAM registers, enabling persistent modification of device state and configuration. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS 4.0 base score of 8.8 reflects high confidentiality and availability impact. The vulnerability was self-reported by Acer and is tracked in the EU vulnerability database as EUVD-2026-34223.

Technical ContextAI

The affected device is the Acer Connect M6E, a 5G portable WiFi router running Acer's M6E_AI firmware line. The root issue is that engineering and factory-level diagnostic interfaces - typically used during manufacturing and QA - were not stripped from retail firmware images, so the diagnostic surface remains reachable on shipped units. These diagnostics provide a privileged path into non-volatile RAM (NVRAM), where boot parameters, calibration data, network settings, and persistent configuration are stored. The CWE assignment of CWE-134 (Use of Externally-Controlled Format String) is unusual for a diagnostic-exposure issue and likely reflects the specific code-level primitive that grants the NVRAM write capability, rather than the high-level design flaw of leaving diagnostic tooling enabled.

RemediationAI

Apply the firmware release that supersedes M6E_AI_1.00.000019 as published in the Acer advisory at https://community.acer.com/en/kb/articles/19707; the exact patched version string is not enumerated in the provided intelligence, so confirm the build number against Acer's release notes before deploying. Patch status from available data: patch available per vendor advisory. Until firmware is updated, reduce exposure by isolating the router on a dedicated management VLAN, disabling guest and untrusted Wi‑Fi access so unverified clients cannot reach the device, and avoiding installation of any companion mobile applications that have not been vetted, since the description ties exploitation to 'malicious apps' with reach into device diagnostics. These compensating controls reduce attack surface but do not remove the underlying diagnostic interfaces, so they are temporary measures only.